[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: Question on the safety sharing NFS with untrusted machines.

On Thu, Jul 25, 2002 at 01:07:19PM -0500, Dast wrote:

> So my question is, is it safer to host the NFS from the DMZ and
> mount remotely on machines in the internal network, or host the NFS
> from a machine on the internal network and remotely mount in the
> DMZ?  Or does it matter?

I suppose it depends on what sort of activity you need to do over the
NFS mount. Whoever gets root on an NFS client effectively gets access
to both root-owned and user-owned files on the NFS share, whether
directly or via su. Whoever gets root on the NFS server can obviously
mess with the clients pretty heavily.

With a non-compromised server in the internal network, you do have the
options to share the NFS area read-only, and/or squash root access to
be identical to some unpriveleged user.

So if the need for NFS access is something along the lines of needing
access to files in people's public_html directories for web serving,
I'd put the NFS server on the internal network, share out /home as
read-only and let each user manage their permissions in the
public_html directory. Perhaps a better solution would be to put all
user web files into a single tree outside their home, and only share
that area.

Having no idea what you intend to do with the NFS mount, I'll refrain
from further examples.

Mike Renfro  / R&D Engineer, Center for Manufacturing Research,
931 372-3601 / Tennessee Technological University -- renfro@tntech.edu

To UNSUBSCRIBE, email to debian-security-request@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org

Reply to: